Integrations (GTM, WordPress…)

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 15, 2026

Integrations (GTM, WordPress…)

Every integration below installs the same canonical embed — a single <script id="CookieMunch"> tag. Pick the channel that matches your stack; you don't need more than one.

What you need

Host — your Cookie Munch server origin, e.g. https://api.cookiemunch.net.
Site ID (cbid) — from the dashboard, or GET /v1/sites/{cbid}/snippet / client.sites.snippet(cbid) (see sites & config), which returns the exact tag pre-filled for you.

The canonical embed

Place this as high in <head> as possible — ideally the very first script — so automatic prior-blocking can intercept trackers before they run:

<script id="CookieMunch"
        src="https://<host>/consent.js"
        data-cbid="<SITE_ID>"
        data-blockingmode="auto"></script>

Attribute	Required	Values	Meaning
`id="CookieMunch"`	yes	`CookieMunch`	Lets the engine find its own script tag to read config from.
`src`	yes	`https://<host>/consent.js`	The embed served by your Cookie Munch server.
`data-cbid`	yes	your site id	Identifies this site in your dashboard.
`data-blockingmode`	yes	`auto` \| `manual` \| `checklist`	`auto` blocks third-party scripts until consent; `manual` never blocks; `checklist` blocks per category.
`data-culture`	no	e.g. `en`, `de`	Optional banner language override.
`data-api`	no	`https://<api-host>`	Only needed when `consent.js` is served from a CDN separate from the API (beacons + the TCF bundle go here instead).

The cookie-declaration table (for a Cookie Policy page) is a second, optional embed placed in the page body:

<script src="https://<host>/cookie-declaration.js" data-cbid="<SITE_ID>"></script>

WordPress plugin

Location: plugins/wordpress/forgeconsent/ in this repo.

Upload the folder to wp-content/plugins/ (or zip it and upload via Plugins → Add New → Upload Plugin), then activate it.
Configure under Settings → Cookie Munch: API host / base URL, Site ID (cbid), blocking mode (auto/manual), culture (optional), and an enable/disable toggle.
The plugin injects the embed into <head> at wp_head priority 1 — as early as possible, so prior-blocking works even on themes/plugins that enqueue analytics scripts aggressively.
Render the cookie table anywhere with the [cookiemunch_cookie_declaration] shortcode.

Google Tag Manager

Location: integrations/gtm/. Two install paths — pick one:

Option 1 — Custom Template (recommended)

In GTM, open your Web container → Templates → New (under Tag Templates).
In the template editor's overflow menu (⋮) → Import → select integrations/gtm/template.tpl from this repo → Save.
Tags → New → Tag Configuration → choose Cookie Munch (under "Custom"). Fill in: API host/base URL, Site ID (cbid), blocking mode, optional culture.
Triggering → Consent Initialization - All Pages (fall back to Initialization - All Pages if unavailable) — this fires before every other trigger, so the auto-blocker installs first.
Save, then Submit / Publish the container.

Option 2 — Custom HTML tag (fallback)

Tags → New → Tag Configuration → Custom HTML, paste the canonical embed with <host> / <SITE_ID> filled in.
Leave "Support document.write" unchecked.
Triggering → Consent Initialization - All Pages (or Initialization - All Pages).
Save and Submit / Publish.

Note: the Custom Template passes cbid, blockingmode, and culture both via the consent.js query string and a window.CookieMunchConfig global, since GTM's sandboxed injectScript API can't set arbitrary data-* attributes. The Custom HTML fallback uses the literal data-* attributes and is byte-for-byte identical to the standard install — use it when you need exact parity.

Copy-paste snippets

Location: integrations/snippets/. Per-platform, paste-where guides for site builders that don't have a dedicated plugin:

Platform	Guide
Shopify	`integrations/snippets/shopify.md` — paste into `theme.liquid`, immediately after `<head>`, before any analytics/pixel/app scripts.
Wix	`integrations/snippets/wix.md` — Settings → Custom Code, added to the `<head>` of all pages.
Webflow	`integrations/snippets/webflow.md` — Site Settings → Custom Code → Head Code (site-wide).
Generic HTML	`integrations/snippets/generic-html.md` — for any hand-built or templated site.

Each guide uses the same canonical embed and the same cookie-declaration embed for a Cookie Policy page.

Shopify example

<!-- theme.liquid, immediately after <head> -->
<script id="CookieMunch"
        src="https://<host>/consent.js"
        data-cbid="<SITE_ID>"
        data-blockingmode="auto"></script>

If your theme has multiple layout files (theme.liquid, checkout.liquid), add the snippet to each one you want the banner on. Full checkout customization requires Shopify Plus.

Generating the snippet programmatically

Rather than hand-copying the template, fetch it pre-filled for a specific site — useful for a self-serve onboarding flow or a deploy script that injects the tag into a CMS:

curl -H "Authorization: Bearer $COOKIEMUNCH_API_KEY" \
  "https://api.cookiemunch.net/v1/sites/YOUR_CBID/snippet?blockingmode=auto&culture=en"

{
  "snippet": "<script id=\"CookieMunch\"\n  src=\"https://api.cookiemunch.net/consent.js\"\n  data-cbid=\"YOUR_CBID\"\n  data-blockingmode=\"auto\"\n  data-culture=\"en\"></script>",
  "src": "https://api.cookiemunch.net/consent.js",
  "api": "https://api.cookiemunch.net",
  "cbid": "YOUR_CBID",
  "blockingMode": "auto"
}

const { snippet } = await client.sites.snippet(cbid, { blockingMode: 'auto', culture: 'en' });

See sites & config for the full endpoint reference, and the MCP get_install_snippet tool for the same capability from an agent.

Verify the install

After installing on any channel: open the site, open browser devtools, and confirm a request to https://<host>/consent.js fires and the banner appears on first visit. Then run POST /v1/sites/{cbid}/verify (dns/meta/file challenge) to unlock consent export and signed receipts for the domain.

Was this page helpful?